diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a36ee815..e19926a0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -81,26 +81,35 @@ jobs:
           # NOTE: keep every run: block pure ASCII. The runner writes this block
           # to a BOM-less .ps1 executed by Windows PowerShell 5.1, which decodes
           # it as GBK -- non-ASCII bytes there break string quoting.
-          $ErrorActionPreference = 'Stop'
+          $repoRoot = (Get-Location).Path
 
           # --- pick a Python that actually has pre-commit -------------------
           # The runner runs as SYSTEM, whose PATH is NOT the dev user's PATH.
           # On this box SYSTEM's `python` is C:\msys64\...\python.exe (3.14.5,
           # no pre-commit). Probe the same order as scripts/ci_local.py:
-          #   current interpreter -> .venv -> anaconda3
-          $repoRoot = (Get-Location).Path
+          #   PATH python -> .venv -> anaconda3
+          #
+          # CAUTION: a failing native command writes to stderr; with
+          # $ErrorActionPreference='Stop' that would abort the whole script
+          # (NativeCommandError) before the next candidate is tried. So relax
+          # the preference around each probe, and restore it afterwards.
           $candidates = @(
             (Get-Command python -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Source),
             (Join-Path $repoRoot '.venv\Scripts\python.exe'),
             'C:\ProgramData\anaconda3\python.exe'
           )
           $py = $null
+          $saved = $ErrorActionPreference
           foreach ($c in $candidates) {
             if (-not $c) { continue }
             if (-not (Test-Path $c)) { continue }
-            & $c -m pre_commit --version *> $null
-            if ($LASTEXITCODE -eq 0) { $py = $c; break }
+            $ErrorActionPreference = 'Continue'
+            & $c -m pre_commit --version 2>&1 | Out-Null
+            $rc = $LASTEXITCODE
+            $ErrorActionPreference = $saved
+            if ($rc -eq 0) { $py = $c; break }
           }
+          $ErrorActionPreference = 'Stop'
           if (-not $py) {
             Write-Host "::error::no Python with pre-commit found. Tried: $($candidates -join ' | ')"
             exit 1
@@ -119,7 +128,7 @@ jobs:
           } elseif (Test-Path 'C:\Program Files\Cppcheck\cppcheck.exe') {
             $dir = 'C:\Program Files\Cppcheck'
             $env:Path = "$env:Path;$dir"
-            "C:\Program Files\Cppcheck" | Out-File -FilePath $env:GITHUB_PATH -Append
+            $dir | Out-File -FilePath $env:GITHUB_PATH -Append
             Write-Host "cppcheck not on PATH; added $dir (User-scope PATH is invisible to SYSTEM)"
           } else {
             Write-Host "::error::runner missing cppcheck -- install it, then re-run"